[github.com/gardener/gardener:v1.151.0]

⚠️ Breaking Changes

• [OPERATOR] The resources.gardener.cloud/delete-on-invalid-update=true annotation was removed from the node-local-dns DaemonSet. The annotation was previously used due to changes in the label selector and pod template labels introduced in https://github.com/gardener/gardener/pull/14286.
  The node-local-dns is a DaemonSet installed in Shoot clusters via ManagedResource. For hibernated shoot clusters, the gardener-resource-manager is scaled to 0 and there is a chance that the changes to the labels were not applied.
  Before upgrading to this gardenlet version, operators need to ensure that the changes to the labels were applied for all such clusters.
  To do that, operators can compare the generation and status.observedGeneration of the shoot-core-node-local-dns ManagedResource with the script from this gist. by @plkokanov [#14948]
• [DEPENDENCY] The following extension and admission chart value have been deprecated and will be removed soon:
• gardener.runtimeCluster.enabled (replaced by gardener.clusterTypes.runtimeGardenCluster)
• gardener.virtualCluster.enabled (no substitution since non virtual garden clusters are not supported anymore) by @timuthy [#15566]

📰 Noteworthy

• [OPERATOR] The memory footprint of the gardener-admission-controller was improved for audit, authentication, and authorization config validators. by @timuthy [#15624]
• [OPERATOR] Gardener Operator has changed the naming scheme for ManagedResources created for extensions. The old scheme was extension-<extension-name>-garden, which has been replaced by garden-extension-<extension-name>-<5-char-checksum>.
  A migration of related resources is triggered automatically during the operator's startup. by @timuthy [#15669]
• [DEVELOPER] A new documentation about the status in Gardener APIs has been added to /docs/development/status.md, containing general information and guidelines. by @timuthy [#15527]
• [DEVELOPER] Add explicit GOTOOLCHAIN version in Makefile that controls and enforces the Go version used for image builds for more consistent Go version use. Extension developers are advised to do the same in their root Makefiles. by @LucaBernstein [#15588]

✨ New Features

• [DEPENDENCY] The ControllerInstallation controller as well as the Extension and Admission controller of the Gardener Operator now pass gardener.clusterTypes values to the Helm chart based deployments, allowing them to deploy or skip resources depending on the cluster setup. Read more about it here and here. by @timuthy [#15566]

🐛 Bug Fixes

• [OPERATOR] Only configure Prometheus to scrape OpenTelemetry node metrics when shoot node logging is enabled. by @matthias-horne [#15634]
• [USER] Shoot maintenance is no longer reported as Failed when an automatic ETCD encryption key rotation cannot be started because a rotation is already in progress. The rotation is skipped and reevaluated in the next maintenance window instead. by @timebertt [#15630]
• [DEVELOPER] make format no longer scans the module cache to fix imports, reducing its runtime from several minutes to a few seconds. by @ialidzhikov [#15650]

🏃 Others

• [OPERATOR] gardenadm discover new/existing now also export the Secrets/ConfigMaps referenced by a ControllerDeployment (via its .resources field as well as the Helm OCIRepository pull secret and CA bundle). This ensures a subsequent gardenadm init/restore can resolve the referenced resources when templating the extension Helm values. by @dimitar-kostadinov [#15658]
• [OPERATOR] gardenadm restore now deletes the prior control plane Node and its Pods (restored from the etcd backup) before running the init flow, preventing phantom/stale objects from confusing the flow (e.g. Pod network setup) or the kube-scheduler. by @ialidzhikov [#15590]
• [OPERATOR] istio-client-certificate is now valid for 45 days, but still renewed every 15 days. by @ScheererJ [#15605]
• [OPERATOR] The false deprecation warning for spec.dns.providers[].secretName is no longer emitted for Shoots whose secretName is synced from credentialsRef. The warning still appears when the deprecated field is set by the user. by @mvanhorn [#15016]
• [OPERATOR] The OCM component descriptor was fixed for component etcd-backup-restore. by @timuthy [#15643]
• [OPERATOR] Integrated kube-api-linter as a golangci-lint plugin to enforce Kubernetes API conventions (JSON tags) on API types in pkg/apis/. by @DobromirNPeev [#15550]
• [OPERATOR] Increased the failure threshold and added an explicit timeout to the shoot metrics-server liveness probe to avoid spurious container restarts caused by occasional slow /livez responses. by @pujitha24 [#15649]
• [DEVELOPER] Including hack/tools.mk in a repository that does not depend on github.com/gardener/gardener no longer prints an error on every make invocation. by @cerealsnow [#15616]
• [DEPENDENCY] The following dependencies have been updated:
• gcr.io/istio-release/pilot from 1.29.6 to 1.29.7.
• gcr.io/istio-release/proxyv2 from 1.29.6 to 1.29.7.
• istio.io/api from v1.29.6 to v1.29.7. by @gardener-ci-robot [#15606]
• [DEPENDENCY] The following dependencies have been updated:
• registry.k8s.io/cpa/cluster-proportional-autoscaler from v1.10.3 to v1.11.0. by @gardener-ci-robot [#15652]
• [DEPENDENCY] The following dependencies have been updated:
• quay.io/kiwigrid/k8s-sidecar from 2.10.1 to 2.10.3. by @gardener-ci-robot [#15618]
• [DEPENDENCY] The following dependencies have been updated:
• envoyproxy/envoy from distroless-v1.39.0 to v1.39.1. Release Notes
• envoyproxy/envoy from v1.39.0 to v1.39.1. by @gardener-ci-robot [#15600]
• [DEPENDENCY] The following dependencies have been updated:
• gardener/etcd-druid from v0.38.1 to v0.38.2. Release Notes
• github.com/gardener/etcd-druid/api from v0.38.1 to v0.38.2. by @gardener-ci-robot [#15633]
• [DEPENDENCY] The following dependencies have been updated:
• quay.io/kiwigrid/k8s-sidecar from 2.10.3 to 2.11.2. by @gardener-ci-robot [#15663]
• [DEPENDENCY] The following dependencies have been updated:
• VictoriaMetrics/VictoriaLogs from v1.50.0 to v1.52.0. Release Notes by @gardener-ci-robot [#15441]

application/spdx+json

• admission-controller-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:0f67ecb293a2e98836acc21656e2eb3c7323a937495e47944837fb08a5d892e5
• admission-controller-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:3d76e011f9ae5a647a0ea30c6ebdd7a184b8682ae5a4c6215da985156d8841fa
• apiserver-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:3adff0c22ca0175a1d8f29e641a35cb47c02ef3a5dbe8252f5d85b1057248e9a
• apiserver-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:c7ee5a99b75b0ef083dbd3a3c9f91be5d57235fe801f17a44c343a0f63fd6149
• controller-manager-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:1ea63f5bbc436457d9af5d17bf0881dc686e030970137ecc1186c4c636a13044
• controller-manager-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:ebcf6d3c34801cacf3e257dec8356383c51d61e45c17d802be6b712a66b780d2
• gardenadm-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:06f32dc629895235850fe6392a31a3d1cf56184e99c5115858880d7ae27eb692
• gardenadm-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:460d5483e0643c9cb1ae327f08635da1199675619f526272f63f6bef40146f36
• gardenlet-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:47c32973187401b49b079ae4a2f4f23cf6a4394c615e6377581f9e873d9a71ce
• gardenlet-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:f742ff52fb601f92fad0f5d663fa13b126431eeb52b9b4c76b256625af2b2e3d
• node-agent-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:bfa7b5e7c4f805433e6a88376bcd05be3c969f7b275feb1c3846851caaef743c
• node-agent-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:d4f79cd7e0e7d984f148fa173798c7986a61f0d9ac2f6d5de09e1f5e645f42f4
• operator-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:71d8e62f37956faa9f5ea453f3094d1421e222f07fd2715e388f44dcf9b62262
• operator-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:c377ce857255434bada03cab83914673e7c6509c108e1a6b6c70266ad3002ede
• resource-manager-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:3aa359ee6affc60aaee6dde106717ee89fb136c5bce543626e098b8cd05607ec
• resource-manager-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:b6218c0eb4c893d9185717b4a7b84f53f3648d5e296a8ad940b9690d546a1daa
• scheduler-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:90bbbee6152b04d8c7c2599f319ade1dd15e095afbf0ef4409295bc759d1a730
• scheduler-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:f34bbaf833b28fc8d9d3b5fbdf0a4d8d32d0eb27e1a87930361a9bc596b2accd

application/vnd.cyclonedx+json

• admission-controller-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:67db680f3742120926f9ec3bf0b172f657e8bf4d98343f6fb872048d8354561e
• admission-controller-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:dfe261af4e0980de0ba9de66e30cd849596a60e82797f05031e830caa5ccd56a
• apiserver-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:0c052773640a848db8a27f8f9a3b164b96bddd15efd59d66a7c4b7f32fb3d96d
• apiserver-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:7750d03a5f432385e2481cd38b28beddf0b739341938707e5b5d587be2a26682
• controller-manager-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:3a51eeb5a22f45d1e7f08b911e3ed72ac6151653383cce3c65c476d652f9552b
• controller-manager-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:f34c498bb7c27ef0e69af6285552c430a1d6b82c04f0e8c8d3d0972e5d139d1e
• gardenadm-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:3e8094e5ea0a63d902431738d4c16af1d8e2b6d517f88b8932b0625429313c92
• gardenadm-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:b536cc3ebeec76ee5f568f6e4198ab1978766963313e0b6afcc895392787a212
• gardenlet-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:a8e8f0ee6f2f9152bdbadb5455226ddd94aaa166f901b2b4f5fe02572dd1fc77
• gardenlet-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:d509c876365b6153cedad763d8b4412168aa515ec097d8aca6ecf1351738abe1
• node-agent-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:8c2ef86076e3856985ab6255ff3012941966894723dbee1d874c1e560394b396
• node-agent-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:c5b78339218ded74cc5e3b17ff579e547f15918b413d0a26f1c41eced07a8cd5
• operator-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:544833c348e4de12f23c479f03e665a96e9f50e8dea77a2ad3e6a85b0a06f7cd
• operator-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:54d1974d306f0d89a6edbebf67a994fc1ea8dab8b484a7c0d12dd1416834424d
• resource-manager-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:8fc56323101eccdacf106b24187361ed4e89d9338974c9b04814043d16cec362
• resource-manager-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:e1973d10f1b3cf2a6de017b34018df74897f02b9adeacfc07ad01a9240684ce2
• scheduler-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:35a310ad886a459548862897fb1be41fe824dce1a699e7810a06df853559e187
• scheduler-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:fcd64ccd8079523ddaafafbab19e610d6364ee74eb0f13135a373bda2d5e7bae

Helm Charts

• gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.151.0
• operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.151.0
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.151.0

Container (OCI) Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.151.0
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.151.0
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.151.0
• gardenadm: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm:v1.151.0
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.151.0
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.151.0
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.151.0
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.151.0
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.151.0